https://community.splunk.com/t5/Getting-Data-In/Sub-Query-on-Syslog-results/m-p/80117#M16484 <P>I have some data (cleaned syslog) that we are using the Top function to see top Destination IP addresses in some log data</P> <P>From the results shown, how can you get it to display data from normal additional queries that I run on this data like | top Src_Address or | top Dst_Port..... wether displayed via a link or inline ...</P> <P>I am guessing its a subquery but cant see how you define this</P> <P>thanks</P> Fri, 29 Oct 2010 15:29:42 GMT ids 2010-10-29T15:29:42Z https://community.splunk.com/t5/Getting-Data-In/Sub-Query-on-Syslog-results/m-p/80117#M16484 <P>I have some data (cleaned syslog) that we are using the Top function to see top Destination IP addresses in some log data</P> <P>From the results shown, how can you get it to display data from normal additional queries that I run on this data like | top Src_Address or | top Dst_Port..... wether displayed via a link or inline ...</P> <P>I am guessing its a subquery but cant see how you define this</P> <P>thanks</P> Fri, 29 Oct 2010 15:29:42 GMT https://community.splunk.com/t5/Getting-Data-In/Sub-Query-on-Syslog-results/m-p/80117#M16484 ids 2010-10-29T15:29:42Z https://community.splunk.com/t5/Getting-Data-In/Sub-Query-on-Syslog-results/m-p/80118#M16485 <P>Splunk has a <CODE>top</CODE> command to do this:</P> <PRE><CODE>... | top Src_Address </CODE></PRE> Wed, 27 May 2015 04:47:05 GMT https://community.splunk.com/t5/Getting-Data-In/Sub-Query-on-Syslog-results/m-p/80118#M16485 woodcock 2015-05-27T04:47:05Z